@@ -0,0 +1,15 @@
+---
+'@objectstack/metadata-protocol': patch
+---
+
+fix(metadata-protocol): the 409 `DESTRUCTIVE_CHANGE` that makes a `controlled_by_parent` detail's master required now counts the stored rows with no master and says they become unreadable to everyone
+
+Clause-②: no
+Metadata-protocol: none
+
+Saving "Controlled by parent" on a detail whose `master_detail` was not required answers 409 `DESTRUCTIVE_CHANGE` with a `field_required_no_default` finding. Its message said only that "existing rows with null values may fail validation". Under `controlled_by_parent` a row with no master has no reader at all (ADR-0055 §1, fail-closed): after publish the list answers `total: 0` and the by-id read and write answer 404, for the admin too, while the row stays stored.
+
+- **What the finding says now.** When the saved body is `controlled_by_parent` and the finding is on its `master_detail` field, the save door counts the stored rows whose master is null. If there are any, the finding's `message` (and the 409's own text) says how many, that they become unreadable through every door once the object is controlled by its parent, the admin's included, and to set the master on them first.
+- **Unchanged.** The finding's `code` and `field`, the 409 itself and `?force=true` behave as before; no code or member is added. With no masterless row, or when the count cannot be answered, the message is byte-identical to before. Access derivation is not touched.
+- **Cost.** One system-authority `count` on that column per matching finding. No other save issues a query, and a forced save issues none.
+- **The Studio confirm.** `PackageOwdOverviewPanel` already lists each `issues[].message` in its confirm, so the count reaches the author there with no console change.
@@ -0,0 +1,105 @@
+// Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
+
+/**
+ * [#28665, ADR-0055 §1] The rows a `controlled_by_parent` detail stops
+ * serving, counted into the destructive-change finding that makes its master
+ * required.
+ *
+ * `detectDestructiveObjectChanges` (`protocol.ts`) judges a save from the two
+ * definitions alone and reads no row. Its `field_required_no_default` finding
+ * says "existing rows with null values may fail validation", which is true of
+ * an ordinary field and understates one case by a long way: the master of a
+ * detail that is (or becomes) `controlled_by_parent`. Such a detail derives
+ * every reader from its master, and plugin-security fails closed on a row with
+ * none (ADR-0055 §1), so once the object is controlled by its parent a row
+ * whose master is null answers `total: 0` on the list and 404 on the by-id
+ * read and write, for the admin too. The row is still stored; nothing reads it.
+ *
+ * So for exactly that finding this module asks the table how many rows hold no
+ * master and, when there are any, says so in the finding's own `message`: the
+ * count, the consequence, and the step that avoids it. ⛔ It adds no finding,
+ * no code and no member: the 409 fires where it fired before, `force` lifts it
+ * as before (the gate does not run under `force`, so neither does the count),
+ * and with no such row the finding is byte-identical to before. The Studio
+ * confirm (`PackageOwdOverviewPanel`) already renders each `issues[].message`,
+ * so the count reaches the author with no console change.
+ *
+ * Cost: one `count` query per finding that matches, and none otherwise. An
+ * ordinary save (no finding, or a required toggle on any other field, or on a
+ * master whose object is not `controlled_by_parent`) issues no query. A count
+ * that cannot be answered (no table yet, a driver fault) leaves the finding as
+ * it was: this is a warning's precision, not a gate, and the 409 still stands.
+ */
+
+/** One Phase 3a-destructive finding, the shape `detectDestructiveObjectChanges` returns. */
+export interface DestructiveFinding {
+    code: string;
+    field?: string;
+    message: string;
+}
+
+/**
+ * Counts the stored rows of the object being saved whose `field` holds no
+ * value. Called with system authority by the save door: the question is what
+ * the table holds, not what the caller can read.
+ */
+export type NullMasterRowCounter = (field: string) => Promise<number>;
+
+/**
+ * The field names whose `field_required_no_default` finding is the master a
+ * `controlled_by_parent` detail derives its access from, judged on the
+ * definition the save writes (`next`). The previous sharing model does not
+ * matter: a detail switched to `controlled_by_parent` in this save and one
+ * that already was both stop serving a masterless row once this lands.
+ */
+export function controlledByParentMasterFindings(
+    findings: readonly DestructiveFinding[],
+    next: unknown,
+): DestructiveFinding[] {
+    if (!next || typeof next !== 'object') return [];
+    const body = next as { sharingModel?: unknown; fields?: unknown };
+    if (body.sharingModel !== 'controlled_by_parent') return [];
+    const fields = body.fields && typeof body.fields === 'object' ? body.fields as Record<string, { type?: unknown }> : {};
+    return findings.filter((finding) => finding.code === 'field_required_no_default'
+        && typeof finding.field === 'string'
+        && fields[finding.field]?.type === 'master_detail');
+}
+
+/**
+ * The findings with each `controlled_by_parent` master's null-master row count
+ * written into its message. Findings that do not match, a count of zero and a
+ * count that fails all come back unchanged; the array keeps its order.
+ */
+export async function withNullMasterRowCounts(
+    findings: DestructiveFinding[],
+    next: unknown,
+    objectName: string,
+    countNullMasterRows: NullMasterRowCounter,
+): Promise<DestructiveFinding[]> {
+    const masters = controlledByParentMasterFindings(findings, next);
+    if (masters.length === 0) return findings;
+    const counted = new Map<DestructiveFinding, number>();
+    for (const finding of masters) {
+        let rows: number;
+        try {
+            rows = await countNullMasterRows(finding.field as string);
+        } catch {
+            continue;
+        }
+        if (Number.isFinite(rows) && rows > 0) counted.set(finding, rows);
+    }
+    if (counted.size === 0) return findings;
+    return findings.map((finding) => {
+        const rows = counted.get(finding);
+        return rows === undefined ? finding : { ...finding, message: nullMasterMessage(objectName, finding.field as string, rows) };
+    });
+}
+
+/** The finding's message once the count is known to be positive. */
+function nullMasterMessage(objectName: string, field: string, rows: number): string {
+    const subject = rows === 1 ? `1 existing row has no '${field}'` : `${rows} existing rows have no '${field}'`;
+    return `Field '${field}' is now required but has no default value, and '${objectName}' is controlled by its parent: `
+        + `${subject}, and once the object is controlled by its parent ${rows === 1 ? 'it becomes' : 'they become'} `
+        + 'unreadable through every door, the admin\'s included (a detail with no master has no reader, ADR-0055). '
+        + `Set '${field}' on ${rows === 1 ? 'that row' : 'each of them'} first.`;
+}
@@ -466,6 +466,8 @@ import { rollBackUnmanagedImport, unmanagedImportCollisions } from './protocol-u
 import { datasourceCredentialsRefSaveRefusal } from './protocol-datasource-credentials-ref.js';
 // [#28355] The `denied` row the four single-item doors leave for a refusal that writes none of its own.
 import { withRefusalAudit } from './protocol-refusal-audit.js';
+// [#28665] The null-master rows a `controlled_by_parent` detail stops serving, counted into the finding that makes its master required.
+import { withNullMasterRowCounts } from './protocol-destructive-null-master.js';
 
 /**
  * Canonical Zod schema per metadata type lives in
@@ -21481,7 +21483,14 @@ export class ObjectStackProtocolImplementation implements
                 } as any);
                 const prev = (existing as any)?.item;
                 if (prev) {
-                    const issues = detectDestructiveObjectChanges(prev, request.item);
+                    // [#28665, ADR-0055 §1] The master of a `controlled_by_parent`
+                    // detail made required: its finding names how many stored rows
+                    // hold no master, since those stop serving everyone. One count
+                    // per such finding, none on any other save; see the module.
+                    const issues = await withNullMasterRowCounts(
+                        detectDestructiveObjectChanges(prev, request.item), request.item, request.name,
+                        (field) => this.engine.count(request.name, { where: { [field]: { $null: true } }, context: { isSystem: true } }),
+                    );
                     if (issues.length > 0) {
                         // [commit 809e61221] Deliberately NOT trimmed to a headline, and
                         // this is a MEASURED verdict rather than an oversight —
 
@@ -0,0 +1,190 @@
+// Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
+
+import { describe, it, expect, beforeEach, afterEach, vi } from 'vitest';
+import { ObjectStackProtocolImplementation, resetEnvWritableMetadataTypes } from '@objectstack/metadata-protocol';
+import { SchemaRegistry } from './registry.js';
+
+/**
+ * [#28665, ADR-0055 §1] Making a detail `controlled_by_parent` with its
+ * `master_detail` turned required: the 409 `DESTRUCTIVE_CHANGE` finding counts
+ * the stored rows that hold no master and says they become unreadable to
+ * everyone, the admin included. Before, it said only that such rows "may fail
+ * validation", and the Studio confirm relayed that.
+ *
+ * Pinned, through the real `saveMetaItem` gate:
+ *  - N masterless rows: the finding (and the 409's message) names N and the
+ *    consequence; the count is ONE system-authority `count` on that column;
+ *  - zero masterless rows, or a count that fails: today's finding, unchanged;
+ *  - `force: true` still saves, and asks nothing;
+ *  - every other save issues no count at all.
+ *
+ * Harness: the shape `protocol-destructive.test.ts` uses (a tenant-authored
+ * object in a `SchemaRegistry`, a mock engine), with a `count` that answers
+ * from a row list by the `$null` predicate it is handed.
+ */
+
+const TODAY = "Field 'project' is now required but has no default value — existing rows with null values may fail validation.";
+
+const masterField = (required: boolean) => ({
+    name: 'project', type: 'master_detail', reference: 'qow_project', ...(required ? { required: true } : {}),
+});
+
+/** The detail as published: `private`, its master not required. */
+const storedTask = (over: Record<string, unknown> = {}) => ({
+    name: 'qow_task',
+    label: 'Task',
+    _provenance: 'org',
+    sharingModel: 'private',
+    fields: {
+        name: { name: 'name', type: 'text' },
+        project: masterField(false),
+    },
+    ...over,
+});
+
+/** The body Studio's "Make required and save" sends. */
+const controlledTask = (over: Record<string, unknown> = {}) => ({
+    name: 'qow_task',
+    label: 'Task',
+    sharingModel: 'controlled_by_parent',
+    fields: {
+        name: { name: 'name', type: 'text' },
+        project: masterField(true),
+    },
+    ...over,
+});
+
+describe('[#28665] the controlled_by_parent master finding counts the rows with no master', () => {
+    let protocol: ObjectStackProtocolImplementation;
+    let registry: SchemaRegistry;
+    let mockEngine: any;
+    let taskRows: Array<Record<string, unknown>>;
+
+    function boot(stored: Record<string, unknown> = storedTask()) {
+        registry = new SchemaRegistry({ multiTenant: false });
+        registry.registerObject({
+            name: 'qow_project', label: 'Project', _provenance: 'org', sharingModel: 'private',
+            fields: { name: { name: 'name', type: 'text' } },
+        } as any, 'pkg');
+        registry.registerObject(stored as any, 'pkg');
+        mockEngine = {
+            registry,
+            find: vi.fn().mockResolvedValue([]),
+            findOne: vi.fn().mockResolvedValue(null),
+            insert: vi.fn().mockResolvedValue({ id: 'x' }),
+            update: vi.fn().mockResolvedValue({ id: 'x' }),
+            delete: vi.fn().mockResolvedValue({ deleted: 1 }),
+            aggregate: vi.fn().mockResolvedValue([]),
+            // Answers only the has-no-value question on one column, with system
+            // authority; anything else is a shape this gate does not send.
+            count: vi.fn(async (object: string, query: any) => {
+                if (object !== 'qow_task') throw new Error(`count on unexpected object ${object}`);
+                if (query?.context?.isSystem !== true) throw new Error('count without system authority');
+                const [[field, predicate]] = Object.entries(query?.where ?? {}) as Array<[string, any]>;
+                if (predicate?.$null !== true) throw new Error('count without a $null predicate');
+                return taskRows.filter((r) => r[field] === null || r[field] === undefined).length;
+            }),
+        };
+        protocol = new ObjectStackProtocolImplementation(mockEngine);
+    }
+
+    const refusalOf = async (run: () => Promise<unknown>): Promise<any> => {
+        try {
+            await run();
+        } catch (err) {
+            return err;
+        }
+        throw new Error('expected the save to be refused');
+    };
+    const masterFinding = (err: any) => (err.issues as any[]).find((i) => i.code === 'field_required_no_default' && i.field === 'project');
+
+    beforeEach(() => {
+        ObjectStackProtocolImplementation.resetEnvWritableCache();
+        resetEnvWritableMetadataTypes();
+        taskRows = [
+            { id: 't1', name: 'orphan-1', project: null },
+            { id: 't2', name: 'orphan-2', project: null },
+            { id: 't3', name: 'owned', project: 'p1' },
+        ];
+        boot();
+    });
+
+    afterEach(() => {
+        ObjectStackProtocolImplementation.resetEnvWritableCache();
+        resetEnvWritableMetadataTypes();
+    });
+
+    it('names how many stored rows have no master and that they become unreadable through every door', async () => {
+        for (const mode of [undefined, 'draft'] as const) {
+            mockEngine.count.mockClear();
+            const err = await refusalOf(() => protocol.saveMetaItem({
+                type: 'object', name: 'qow_task', item: controlledTask(), ...(mode ? { mode } : {}),
+            }));
+            expect(err).toMatchObject({ code: 'DESTRUCTIVE_CHANGE', status: 409 });
+            const finding = masterFinding(err);
+            expect(finding.message).toContain("2 existing rows have no 'project'");
+            expect(finding.message).toContain('unreadable through every door');
+            // The 409's own text carries it too: the faces that quote only the message.
+            expect(err.message).toContain("2 existing rows have no 'project'");
+            expect(mockEngine.count).toHaveBeenCalledTimes(1);
+            expect(mockEngine.count).toHaveBeenCalledWith('qow_task', { where: { project: { $null: true } }, context: { isSystem: true } });
+        }
+    });
+
+    it('counts too when the detail already was controlled_by_parent and its master becomes required now', async () => {
+        boot(storedTask({ sharingModel: 'controlled_by_parent' }));
+        taskRows = [{ id: 't1', project: null }];
+        const err = await refusalOf(() => protocol.saveMetaItem({ type: 'object', name: 'qow_task', item: controlledTask() }));
+        expect(err).toMatchObject({ code: 'DESTRUCTIVE_CHANGE', status: 409 });
+        expect(masterFinding(err).message).toContain("1 existing row has no 'project'");
+    });
+
+    it('with no masterless row the finding is today\'s, unchanged', async () => {
+        taskRows = [{ id: 't3', project: 'p1' }];
+        const err = await refusalOf(() => protocol.saveMetaItem({ type: 'object', name: 'qow_task', item: controlledTask() }));
+        expect(err).toMatchObject({ code: 'DESTRUCTIVE_CHANGE', status: 409 });
+        expect(masterFinding(err).message).toBe(TODAY);
+        expect(mockEngine.count).toHaveBeenCalledTimes(1);
+    });
+
+    it('a count that cannot be answered leaves today\'s finding, and the 409 stands', async () => {
+        mockEngine.count.mockRejectedValueOnce(Object.assign(new Error('no such table: qow_task'), { code: 'SQLITE_ERROR' }));
+        const err = await refusalOf(() => protocol.saveMetaItem({ type: 'object', name: 'qow_task', item: controlledTask() }));
+        expect(err).toMatchObject({ code: 'DESTRUCTIVE_CHANGE', status: 409 });
+        expect(masterFinding(err).message).toBe(TODAY);
+    });
+
+    it('force=true still saves, and asks the table nothing', async () => {
+        const saved = await protocol.saveMetaItem({ type: 'object', name: 'qow_task', item: controlledTask(), force: true });
+        expect(saved).toMatchObject({ success: true });
+        expect(mockEngine.count).not.toHaveBeenCalled();
+    });
+
+    describe('every other save issues no count', () => {
+        it('a master made required on a detail that is not controlled_by_parent: today\'s finding, no count', async () => {
+            const err = await refusalOf(() => protocol.saveMetaItem({
+                type: 'object', name: 'qow_task', item: controlledTask({ sharingModel: 'private' }),
+            }));
+            expect(err).toMatchObject({ code: 'DESTRUCTIVE_CHANGE', status: 409 });
+            expect(masterFinding(err).message).toBe(TODAY);
+            expect(mockEngine.count).not.toHaveBeenCalled();
+        });
+
+        it('another field made required on a controlled_by_parent detail: no count', async () => {
+            boot(storedTask({ sharingModel: 'controlled_by_parent', fields: { name: { name: 'name', type: 'text' }, project: masterField(true) } }));
+            const err = await refusalOf(() => protocol.saveMetaItem({
+                type: 'object', name: 'qow_task',
+                item: controlledTask({ fields: { name: { name: 'name', type: 'text', required: true }, project: masterField(true) } }),
+            }));
+            expect(err).toMatchObject({ code: 'DESTRUCTIVE_CHANGE', status: 409 });
+            expect((err.issues as any[]).map((i) => i.code)).toEqual(['field_required_no_default']);
+            expect(mockEngine.count).not.toHaveBeenCalled();
+        });
+
+        it('an ordinary save with no destructive change: no count', async () => {
+            const saved = await protocol.saveMetaItem({ type: 'object', name: 'qow_task', item: storedTask({ label: 'Tasks', _provenance: undefined }) });
+            expect(saved).toMatchObject({ success: true });
+            expect(mockEngine.count).not.toHaveBeenCalled();
+        });
+    });
+});